从提交到信心：迈向开源软件中稳定性导向的风险评估
From Commits to Confidence: Towards Stability-Informed Risk Assessment in Open Source Software
AI总结：
本文研究了开源软件项目稳定性与韧性，发现稳定提交模式能反映项目治理和开发流程，提出需结合社区参与等指标进行稳定性导向的风险评估。
摘要：
开源软件（OSS）创造了数万亿美元的经济价值，并已成为支撑全球组织技术基础设施的关键组成部分。随着这些系统日益依赖于OSS，理解这些项目的演变至关重要。虽然现有的指标提供了关于项目健康的见解，但一个维度仍被低估：项目韧性，即在诸如贡献者离职、安全漏洞和bug报告激增等干扰后恢复到正常运作的能力。我们假设稳定的提交模式可能成为底层项目特征的指标，如成熟的治理、持续的贡献者和稳健的开发流程，这些因素现有研究与韧性相关联。我们的发现显示，只有2%的仓库表现出每日稳定性，29%达到每周稳定性，50%显示月度稳定性，而另一半在所有粒度级别上都不稳定。对50个不稳定仓库的分析表明，86%的活动集中在少数维护者身上，前三名贡献者在过去五年中占提交量的超过50%。相比之下，50个稳定的仓库则更均匀地分配工作，前三名贡献者所占的提交量低于50%。目前的洞察表明OSS项目稳定性具有脆弱性和多维性，表明需要超越提交之外，利用其他考虑因素如社区参与指标和问题或拉取请求 churn 来丰富对稳定性的理解。尽管我们的努力只识别出两个仓库在所有三个时间提交粒度上都实现了稳定性，但进一步研究这些仓库的过程和政策可以提供见解和基础，以在实践中进行稳定性导向的风险评估。
英文摘要：
Open source software (OSS) generates trillions of dollars in economic value and has become essential to the technical infrastructures that power organizations worldwide. As these systems increasingly depend on OSS, understanding the evolution of these projects is critical. While existing metrics provide insights into project health, one dimension remains understudied: project resilience, or the ability to return to normal operations after disturbances such as contributor departures,security vulnerabilities and bug report spikes. We hypothesize that stable commit patterns may serve as an indicator of underlying project characteristics such as mature governance, sustained contributors, and robust development processes, factors that existing research associates with resilience. Our findings reveal that only 2% of repositories exhibit daily stability, 29% achieve weekly stability, and 50\% demonstrate monthly stability, while the remaining half are unstable across all levels of granularity. Analysis of the 50 unstable repositories indicate that 86% of activity is concentrated among a few maintainers, with the top 3 contributors accounting for over 50% of commits in the past 5 years. In contrast, the 50 stable repositories distribute work more evenly, with the top 3 contributors representing less than 50% of commits. Our insights thus far indicate the fragile and multi-dimensional nature of OSS project stability, suggesting a need to go beyond commits to understand how our understanding of stability can be enriched with other considerations such as community engagement metrics and issue or pull request churn. Though our efforts only identified two repositories that achieved stability at all three temporal commit granularities, further investigation into their processes and policies can provide insights and foundations for stability-informed risk assessment in practice.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
